GAE上的程序访问管理员-oauth2

Question

I have a GAE app, with a URL I restrict to admin:

- url: /admin
  script: _go_app
  login: admin

I want to PUT or POST to this url with another Go program. What code do I need to write for the client to authenticate to GAE and dev_server.py? Is there a more sensible way that just mocking a web-browser and logging in? I don't need to authenticate or authorise other users, just the admin account for that app.

Is this OAuth? OAuth2? OpenID? Federated? Something else?

I realise this is a bit of an awkward question, since I'm not even sure what the right way to ask it is. However I am able to post to (in this example) /admin using a web browser after logging in with my (admin) gmail account. In that case the request (sent by Chrome) contains the cookies: __cfduid, ACSID (and what I think are Google Analytics IDs). Presumably one of those is responsible for my authentication. How do I get one of those?

And as a side question, if someone MITMs my connection (over http), can they hijack my admin session by reusing that cookie?

Answer 1

GAE likes OAuth2

Have a look at goauth2 . It seems to be the canonical OAuth2 library for Go. They provide a fairly comprehensive example at https://code.google.com/p/goauth2/source/browse/oauth/example/oauthreq.go .

With regards to your question "Presumably one of those is responsible for my authentication. How do I get one of those?", they state:

To obtain Client ID and Secret, see the "OAuth 2 Credentials" section under the "API Access" tab on this page: https://code.google.com/apis/console/

And, finally, my humble opinion on "if someone MITMs my connection (over http), can they hijack my admin session by reusing that cookie?" is that you should never provide any authenticated connection (nor the connection that does the authentication) over plain http. Especially an admin section.

EDIT: To elaborate on the MITM question, make sure you use HTTPS for any login requests and subsequent requests for the same session, and make sure to set Secure and HttpOnly flags on your cookies.